This invention pertains generally to computer security, and in particular, to detecting and blocking malicious code propagation on computer systems.
Computer systems face a threat of attack by malicious computer code, such as worms, viruses and Trojan horses. As used herein, “malicious computer code” is any code that enters a computer without an authorized user's knowledge and/or without an authorized user's consent.
Malicious code can infect a computer in a number of manners. For example, a user might insert an infected disk or other medium into a computer so that the computer becomes infected when the disk files are accessed. Computers connected to networks are also vulnerable to attack. In a network-based attack, malicious code can be transmitted to the computer as an executable program, for example in an email attachment. In this example, the malicious code might attack the computer when the user clicks on the e-mail attachment, or the e-mail attachment might open automatically when the user reads, or in certain cases previews, the e-mail. In addition, malicious code can even be embedded within the text of the e-mail itself.
Antivirus scanning software can be installed on computers in an attempt to prevent malicious code attacks. Antivirus scanning software scans computer files, including e-mail attachments and e-mails, to detect the presence of malicious code by looking for known malicious code signatures. Thus, antivirus scanning software can only detect the presence of malicious code for which a known signature is available. The antivirus scanning software will generally fail to detect new malicious code until an updated signature for the malicious code is available. Even if this window of time is small, malicious code can still do an enormous amount of damage to computer systems. In addition, antivirus software can detect malicious code using heuristics scanning. While heuristics scanning does not use traditional signatures for detection, even heuristics can miss new malicious code variants.
Behavior blocking software provides another antivirus technique for preventing or minimizing damage caused by malicious code attacks. Behavior blocking software is programmed through a number of policies to permit benign actions on a computer, but to intercede and prevent unauthorized activities that might be malicious. While behavior blocking software also uses signatures for detection of malicious behavior, these signatures are behavioral-based, allowing entire classes of malicious code to be prevented in many variations. For example, a signature for a particular malicious behavior can be used to identify numerous types or variants of malicious code that all engage in this behavior. Behavior blocking software does require updates for new behavior pattern signatures. However, updates are required much less frequently in behavior blocking software compared to the updating requirements of antivirus scanning signatures. Thus, behavior blocking software is less likely than antivirus scanning software to fail to detect malicious code due to lack of sufficiently current information about the code.
Behavior blocking software can potentially stop attacks by new malicious code that would be missed by antivirus scanning software because the code does not yet have a known antivirus scanning signature. However, because behavior blocking software only detects a threat once the malicious code is being executed on a system, the malicious code often has a chance to do damage before detection.
An individual threat can strike a computer system a number of times. For example, an infected e-mail attachment containing the same malicious code can be sent to a user multiple times. The e-mail attachment might appear to be different each time, or appear to originate from a known sender. Allowing a user to execute an infected e-mail attachment numerous times and waiting for the behavior blocking software to detect the behavior each time can pose problems. Additionally, each time the malicious code is executed, the computer system is at risk of an attack that the behavior blocking software might not timely recognize. For example, the malicious code might execute an action that the behavior blocking software will not detect, such as a Trojan action, before replicating itself or executing some other detectable action. As another example, the malicious code can be programmed to execute a damaging action only under certain conditions, such as on a particular day of the week. The behavior blocking software might detect and block the malicious code without damage the first two times it is executed, for example. However, the third execution could occur on a day that triggers the code to strike and cause damage before the software detects the code.
Antivirus scanning software might fail to detect the new malicious code each time it is executed because there is no known signature for the code. However, behavior blocking software only detects new malicious code as it is running on the system, at which point it has possibly already done some damage. Accordingly, there is a need to recognize and remember new malicious code the first time it is executed, so that subsequent execution of the code can be prevented.